MSP Initiative Live with Anup Ghosh from Threatmate

[00:00:00] Welcome to an October 15th edition of the MSP Initiative MSP Podcast. Wow, almost Halloween before we know it. All those decorations will be up and out. Got to get some housekeeping out of the way like we like to do at the beginning of all of these sessions and then we'll get into the good stuff. So here is the housekeeping. MSPinitiative.com, that's where you're going to find pretty much everything we do,

[00:00:28] including recorded versions of these podcasts and it'll link back to YouTube and the podcatchers and whatever platform you're using. Please make sure to like, download, subscribe, forward, all that good stuff. We appreciate it. Thank you to everyone who has been following the Channel Sports Tour. I just got back a couple days ago from London and we took our group of MSPs out to Tottenham Stadium for

[00:00:59] Eagles, Jaguars in London. So that was awesome. We, you know, we started our year in Australia, obviously a bunch here in the U.S., found our way over to London. So full gamut, right? Following the NFL, where the NFL goes. A couple of, there's three games left in the tour this year.

[00:01:19] Steelers at Buccaneers this upcoming Sunday, October 18th at 1 p.m. in Tampa. So I'm looking forward to seeing people on Sunday. We have Chargers at Rams on November 1st. You know, they both split the same stadium, right, guys? Just telling you what you already know, kind of like the Giants and the Jets. So that's at SoFi in Los Angeles.

[00:01:43] That's November 1st, Sunday, 4.05. Although that may be different local time. I think it's 4.05 Eastern time. And then last one is November 15th, two weeks after that, the final game of the tour, 49ers at Cowboys. That'll be Sunday, November 15th.

[00:02:04] Again, I think that's a 4.25 Eastern start. So I think it's a 3.25 Central time start. So anyway, looking forward to seeing the community and the MSP community out there. Love the NFL atmosphere. So if you're interested, make sure to put yourself on the wait list while you still can, as we're nearing the last few of these. And looking forward to seeing anyone who's coming out to Tampa on Sunday.

[00:02:32] We have our final MSP Community Block Party in Sydney, Australia, coming up here in November. So if you're headed out to the Kaseya Connect APAC, we are doing our block party in Darling Harbor, three minutes away from the conference hotel. They call it the ICC there in the harbor where the convention center is.

[00:02:59] So if you're headed to that event, we are doing our block party on November 17th, starting at 8 p.m. You can literally just walk there if you're already going to this conference, or if you just happen to be an MSP in the area and would love the network with the greater community, you're more than welcome to join. Make sure to register again at mspinitiative.com. All the housekeeping now done. You can find all that stuff online.

[00:03:25] And we bring our guest for today, a return guest to the pod, Anope from ThreatMate. How are you doing today? Awesome. Awesome. Really cool stuff with the stadium events. I'm kind of curious how this played out. It's new this year, right? No. So that's a great question. We started it formally last year.

[00:03:46] We did, I think it was like eight games last year from Gulf Henry. We did Dallas, Green Bay, Tampa Bay, Kansas City, Los Angeles. And there's two more I'm missing. But anyway, we did like five, six games there. And then we had great reception. So we brought it back this year, of course, the NFL schedule. So what's the deal? Is it a suite? Is that what it is? A suite?

[00:04:13] Yeah, no, we go a little bit more, you know, because there's only so many people we can fit in a suite. Right. Our largest game last year was 73 people. So as you can imagine, you can't fit 73 people into a suite. Yeah. So, no, what we do is we do a four hour pregame tailgate, all inclusive, right? Amazing. Nearby the stadium, right? That way we get all the networking time and hangout time that we can.

[00:04:38] And then we do blocks of tickets inside the stadium, usually, you know, in one or two sections. Right. And then that way we're all together. Right. So that's a whole it's a whole day event for sure. Right. Because you got four hours tailgating and then they get usually NFL games like three and a half to four hours. It's eight hours. So, yeah, it's a little bit of a time investment. But, you know, for a Philly season ticket holder, that's pretty par for the course. That's amazing.

[00:05:04] So you're are you guys sponsoring the MSP partners to these events or are they paying their own way? That's the idea. So MSPs put themselves on the wait list. And then if you get, you know, approved off the wait list, then you would get your tailgate pass and your game ticket pass, you know, kind of on us. Right. And us, obviously, MSP initiative works with, you know, channel vendors. Right. And we all kind of go in there and split that up. So it is definitely a different.

[00:05:34] That is amazing. For sure. But the NFL. Sorry, if you're a FIFA fan or a hockey fan or a baseball fan, I think the NFL is king. I think that was part and parcel with first NFL game ever in Melbourne, Australia. Hundred thousand in the stadium. So, wow. So they are an international story. Well, this is this is truly amazing. It's a great thing you guys are doing.

[00:06:00] I can't imagine anyone listening not signing up for their city or their favorite team. Yeah, I agree. It's been it's been absolutely blast. And then so one of your your vendor partners. Is it, you know, what have they said about it? Yeah. Well, you know what it is, is we like to give everybody a chance to invite people, you know, that they would love to see at these. Right. So, like, for example, if you came on board and you knew we were going to Dallas and you

[00:06:29] now, you know, you have an existing customers, for example, that you would love to catch up with. Right. Yeah. Like you could, you know, put those people on the list, you know, get a little bit more priority selection. Right. Or we can go to the wait list. And as a group, we can, you know, you know, approve people off the wait list. So that's kind of how we do it. And the good part is, is that everybody's sitting together and everybody's together for the day. So it usually makes it pretty comfortable. Very nice. Very nice. Yes. The channel sports tour.

[00:06:58] So, um, we've done one of these before. So if you, uh, go back in time, all of these podcasts are online. Uh, but, uh, for people who haven't, uh, run into Threatmate or to you personally, maybe just a quick, you know, background, right? So we can set the conversation for the rest of the pod. Yeah. So a little bit of background Threatmate. Uh, we're still in an early stage startup. So we're not one of the big boys like Kaseya and ConnectWise.

[00:07:24] Um, innovators like myself, I came out of, uh, DARPA. If, if any of you guys know DARPA, long time cybersecurity guy, used to build software for the enterprise and then said, wow, this whole market of the SMB is underserved, right? So that was their original genesis is how can we bring enterprise grade technologies down to the small mid market and make it easy.

[00:07:53] So you don't need a cybersecurity, you know, degree or subject matter expertise to run and protect these networks. So that was, um, how we started this business is let's bring some world-class cybersecurity technology to the SMB. And obviously we think that the channel MSP partners is the best way to go to market. Awesome. Well, I mean, there, there is a long story of people who sell enterprise software trying

[00:08:20] to bring that and, you know, square peg round hole in my opinion down. And it's always usually a, you know, uh, over complicatedness. It feels like it may be a price tag that may not jive. Um, so I've seen a lot of that over the years in my own experience. Um, you know, uh, I think that the MSP IT services subcategory is the way I like to, I call

[00:08:46] it sandbox, but the subcategory underneath of the larger technology, you know, realm is a little bit more visible than it was probably even five years ago. For sure. For sure. And you're right. You know, we see it today in cybersecurity, uh, many cybersecurity firms are trying to figure out how to get down to, uh, to the SMB market. Some have done so successfully, uh, like you see with Sentinel-1 and CrowdStrike, for instance,

[00:09:14] and others, like you said, you know, round peg, square hole. Um, a lot of times it's how the product was designed, which is just too difficult for them to kind of unwind that. And then the other side of it is just pricing, pricing and structure. Um, you know, you see people who don't get, uh, the whole multi-tenancy and how we need licenses to apply across all of our clients and instead of a minimum per client, all those things.

[00:09:39] And that's why when we started ThreatMate, it wasn't about just taking, you know, a product and mapping it to, uh, to the, uh, MSP space. It really was a ground up. How do, how do MSPs work? How do we get in their workflows? And by the way, that's a big part of it, right? You don't, you can't presume you're the center of their universe. You kind of have to fit into the workflow. So that's another, you know, big thing that, uh, enterprise, uh, software doesn't quite get.

[00:10:09] Yeah. A hundred percent agree with you. I mean, maybe a more current event topics, but I love to throw these in there. Cause I think, you know, sure. Yeah. Take your opinion, you know, uh, the implosion of SAS, you know, in, you know, for AI, um, um, the vibe, uh, the vibe coding, uh, phenomenon, uh, whether it's still, uh, a flash or ongoing,

[00:10:38] um, the idea that the MSP could, uh, become their own software company, I guess. Yeah. Um, what's your opinion on all of that? I mean, I know that's a lot, but generally speaking, do you, you see it? I'm sure we all do. Yeah. Where do you land on all of it? Look, I see it a lot more in LinkedIn than I do in real life. And I, I track those conversations as mostly vendors who are complaining. Right.

[00:11:08] Um, I think it's kind of funny. Um, but so, so I build a lot of software for my company, uh, not for the product, if that makes sense. Right. So we, we build a product, we sell a product and we have engineers who do that, build it and sell it. And frankly, they don't let me touch it. Um, I do prototype and so on, but, uh, and I should have mentioned I'm co-founder and CEO. Okay.

[00:11:36] So that, that's part of the reason why, uh, mainly I handle the go-to-market stuff. Um, so on the other hand, I'm building real software to manage my business. You know, things like finances, you know, right before this call, I was doing the month end, um, um, you know, closing September books. Right. Um, and traditionally I had a CFO finance person do that. And oftentimes it involves, you know, going to different software applications.

[00:12:05] In my case, a CRM, a bank account, QBO, three different applications, each a SAS application. What used to be the work of a human to pull all that together is now, um, a program built by AI to do all that for me. I just run the script and it takes care of it. Right. So that kind of stuff, I think anything that you can do to make your business operations, uh, more efficient, uh, called the backend stuff. Great.

[00:12:35] Go for it. But just realize you, you own it too. And so I've built out dashboards. I've been pretty public about this. You know, I've built out dashboards and how I call the AI operating system for the company and, you know, truly blown away by what I could build vibe coding. Right. To, to, to the point. And then there's the downside. The downside is the stuff is fragile. Right. API keys, great.

[00:13:02] Uh, processes that should be running all the time break when, when the, when the machine powers down, you are your bug fixer. Right. You are the maintainer. Right. And okay. I get it. I'll do that. Not a problem. It's worth it for me, but I would not sell that software is, is what I would say. Right. Um, because it's too fragile to sell. Um, and that's where I think I would draw the line.

[00:13:30] If you're a MSP definitely should be vibe coding what you're comfortable doing to make things more efficient, make your life easier. Um, but when it comes to sort of the client facing stuff, my case, my client is the MSP. Um, yeah, you got it. You got, you need, you need to make sure it's good. You need to make sure it's maintainable. You need, you know, bug reporting. You need maintenance. You need cycles for all of it. It can't be a hobby. Right. And that's real cost. So that's kind of how I think about it.

[00:13:58] If you're going to do anything that's really client facing and mission critical, you're probably better off letting the people who are experts at that build that. And from a cost perspective, it's more efficient to consume it that way. Um, if you're going to be doing stuff that just makes your life more efficient, you should absolutely be vibe coding that stuff. Okay.

[00:14:20] Well, my view of it anyway, no, this is, this is, uh, this is, um, this is good. So to the people in that realm that say, huh, it's one thing to interconnect existing tools and like speed things up, move data around, create dashboards. That's like kind of like task saving. Right. Which is great.

[00:14:49] But there's people out there saying, Hey, I'm going to start displacing vendors entirely. Right. I'm going to, I'm going to, I'm going to build my own accounting tool. Forget QuickBooks. I'm going to build my own CRM. Forget HubSpot. I'm going to build my own PSA ticketing system. Forget whatever. Right. And now all of a sudden this idea that the source of truth, the record collector that's, you know, been in the middle of all of this is now, I don't know, wherever they park it,

[00:15:18] you know, Vercel or wherever they put it in. Right. So what's your opinion on that part of it? Yeah. Again, it's one of caution. Is it mission critical? Right. Right. So if it's you, I think you can make a judgment about your own ability to manage that. If it's an employee, what happens if that employee leaves? So you've got a really good tech who says, I can build this PSA that's far better than,

[00:15:48] you know, name your standard PSA. You're like, really? And he shows you a demo because he built a dashboard last night. It's really easy to build dashboards. Right. You're like, wow, that's super cool. So I can get rid of that cost every month. Yeah. Well, guess what? You now own that. And if that guy or gal leaves, what are you going to do then? Right.

[00:16:11] So again, I think of it more as a people replacer, which I know doesn't sound great, than a software replacer. So think of, again, closing books is an outcome I'm after. I could have hired an outside consultant to close my books from my existing SaaS software, the systems of record. Right. I'm not going to replace the system of record.

[00:16:38] If I replace the system of record, it'll be with another better system of record, not from something I built. Right. But the person who's delivering the outcome, in this case, closed books, is what I'm building an AI to replace. That's how I think about it. Right. So, you know, and your mileage may vary, but I would say the maintenance, the vibe coding is the easy part. The maintenance, not that easy. Right. Right.

[00:17:07] And managing API keys is important. To your point about Vercel, I use Vercel, love Vercel. But now I'm trying to remember, you know, where did I put everything for that Vercel? Right. Are you doing, are you using GitHub? I hope you are. Are you using .gitignore to make sure your keys aren't going to the source code? Right. All these things. And if you're really serious, do that as your business. If you really think that you can build a better PSA, get serious.

[00:17:36] Drop what you're doing and do only that and be the best at it. Right. Go to market with it. And if you don't have that level of commitment, it's probably not good enough for you. It's kind of how I think about it. Okay. I mean, I love that. I love that feedback. All right. So kind of cousin topic, but the idea that the way people interact with their current tool set,

[00:18:03] SaaS companies, products, whatever, going the way of, hey, I'm just going to have my AI assistant. I'm just going to type, hey, go and do this rather than going into a portal, clicking on a button, pressing a go. Do you feel like that's fad or do you think that that has real staying power? That has real staying power. That has real staying power. And I think it solves real problems too.

[00:18:31] So I'm a heavy user of SaaS because I'm running a business. And most SaaS products built in the 2010s are extremely clunky, very difficult to work with. And so almost always when I'm working the SaaS product, I've got my Gemini window alongside of it. And I'm asking Gemini, how do I do this? How do I find this?

[00:18:56] It's because the own help or the own AI in the product, the chatbot is not good enough. Right. And so what's better than that is, in fact, your own agent that uses an MCP for that software. Right. That's where I think you were going with your question. And that actually is what I'm doing when I close books.

[00:19:21] I'm not actually in the interface to, in our case, Brex or QBO. I'm working with an agent. And the agent is using the MCP to those services and is getting the information it needs and is producing the outputs I need and is writing back. Right. Of course, you have to be careful and put guardrails on these things. But I do think that is likely the future of how we will do. Well, I shouldn't say the future, at least the near term.

[00:19:51] The best way to maximize where we are with AI today are these workflows. Workflows that go between these different stovepipes. And get jobs done. Okay. All right. So then comes the compliance driven questions. Right. Because we had a lot of, before AI became the billboard, cybersecurity was front and center.

[00:20:19] And then like second to cybersecurity was compliance. Right. So now we're in this situation where it's like, hey, I just, I logged in. I subscribed to, you know, Claude Pro or Claude Personal or OpenAI, whatever. And like at the base levels of these subscription plans, they offer, from what I understand, basically no things in this realm. Right. They don't give you the HIPAA.

[00:20:47] They don't give you audit logs. And all of a sudden it's like, well, then how are you still complying with, especially with your customers who are in regulated industries? Like that's how you get dragged into it. So if you're now using these tools, forget for a second if your customer is using this tool. Second question. Yes. First question is you're using the tools, but you're using it at a level that doesn't comply. Now what? Right. Great question. And a super important topic.

[00:21:15] So you're right about being dragged into compliance, right? To some extent, some compliance regimens are viral. They have a viral property. SOC 2 is one of those. So many of our MSP partners come to us and ask for our trust center for our SOC 2 documentation. Why? Because they were required to have SOC 2 documentation from their client. So it's like a drag along type of thing, right?

[00:21:41] So, of course, we have SOC 2 and, of course, we provide that information. But back to your question, when you're using Cloud or OpenAI, do you know whether information is being leaked to the cloud, to these third parties? Do you have control over that information? And so the answer is no, by the way. You don't know. And so that's one. And by the way, you can admit we didn't coordinate before this call.

[00:22:11] But that is one capability that we did release because we consider that an attack surface, right? And largely what ThreatMate does is attack surface management. In this case, the attack surface is employees inadvertently leaking data, right? And so how do they do it? Well, they're doing it through the chatbots or the chat interfaces. And so that entire thing is known as shadow AI, right?

[00:22:41] I guess it's a riff on shadow IT, which is software being used by employees that's not officially sanctioned, right? And so the idea behind shadow AI is to identify who's using AI in the company and what kind of account. Is it a personal account? Is it a corporate account that makes it sanctioned versus unsanctioned?

[00:23:05] And what data is being attached to those sessions that's then going to the cloud, right? So, you know, we looked long and hard at this problem. And most of the vendors were getting about 11% of it. The 11% of it they were getting was looking at O365 authorizations.

[00:23:29] So if I'm using Copilot on my account, there's an authorization that allows Copilot to gain access to my data. And I'm using Copilot. That's for a standard use case scenario. The other use case scenario is I'm on my browser and I'm in claw.ai and I'm just working with claw.ai. That's not an M365 cloud authorization.

[00:23:57] And so if you're not seeing that, you're missing actually the largest segment of AI usage. And then the other part of it is on the desktop. So there are desktop apps for claw and also for open AI, chat GPT. Again, if you're not seeing that usage, you're missing another significant percentage.

[00:24:19] And then the fourth category, if you want to think about this one, is SaaS products that you're using that leverage AI. One that we all seem to use is like note takers and recorders, right? Creating transcriptions of meetings, right? Firefly, all these things that are joining. Are you telling me that the meeting data, the transcripts aren't sensitive information, right? Going to a third party, right?

[00:24:47] So all of that potentially creates problems around compliance, which was your question, right? And so where do you start with all this? Well, where I would start is inventory. Let's get an inventory of what people are using. And by the way, this question I think is the segue question from everyone in the MSP space

[00:25:15] trying to understand what's my angle on AI. Everyone's telling me I need to be a managed intelligence provider. What does that even mean? I agree. I'm big on okay, whatever, right? But I do think this is a great segue to getting there because what it allows you to do to go to your clients, and I also agree with you, start with yourself. Go to your clients and say, look, let's do an inventory.

[00:25:41] Let me do an inventory for you to show you who in your organization is using AI and how are they using it. Are they using their browser? Are they using a desktop app? Are they using their personal accounts? Are they using the corporate accounts? Are they attaching corporate data to this, right? What third party apps are also connected, right? And you start there with an inventory. In other words, don't start with fear. Just let's take a lay of the land, right? Let's produce a report.

[00:26:10] Say, here's your power AI users. Here are the ones using AI. And then what that leads to is an AI acceptable use policy, AUP. If you don't have an AI AUP right now, October 2026, guarantee you will in 2027. And the reason you will is because of cyber insurance policy. That's the other drag along, by the way, right? When you mentioned compliance, cyber insurance policy is a huge drag along thing, too.

[00:26:39] All of a sudden, it's like, oh, yeah, I need this for my cyber insurance policy. Okay. What's your AI acceptable use policy? What? What is that? Right? So just think of it this way. It is your way of delineating, demarking, establishing a policy of what sanction what's not, right? And so if you don't have one, ask us for one. But there's plenty of these templates that are out there. Having a policy, no big deal.

[00:27:07] Being able to observe what is actually happening is the hard part. And that's where our tooling just gives you a report. Here's what people are doing. So I would start with the report. What are people doing? And then decide what's sanctioned and what's not and have a policy emerge from that, right? Once you have a policy. I think there's a need on the haystack on that. And if you built a tool, awesome. It sounds like you have. Like, you made a point.

[00:27:36] I'm going to double down on it now. Like, if I go to Canva, right? Canva has AI built into it. It's not my account. It's their account. I don't know what's powering their tool. I just start typing, right? Right. I mean, right now, if you go to Google, the top part of Google seems like it's Gemini powered, right? It's doing AI searching in addition to the standard Google search, right? Absolutely.

[00:28:00] And so, you know, like, in some cases, you have no control over what's embedded into this place you're going to, right? It's just kind of there. And it's just on. Yes. Right? Yes. So back to what are you using? You may not even have gone and actually signed up for something. It may have just shown up. It's like Shadow IT. It just kind of showed up by Dropbox. People started using it, right? But I think you're exactly right.

[00:28:26] And I think one of the big problems is holding back AI adoption. And I want to be clear on this. I'm not anti-AI, obviously. But I do think one thing that holds companies back from empowering themselves with AI is fear of what might happen to my compliance, right? And so by taking inventory, you can begin to manage it. And the true management of it is called governance, right?

[00:28:55] So once we identify who's using AI for what, then you begin to say, okay, let's talk about what they're doing. By the way, how are they managing the API keys? Really important question, right? Because API keys drive cost. And companies really care about cost, right? So anyone who's spent any time with Claude and OpenAI knows that cost is a massive driver.

[00:29:25] And so if you're not using subscriptions and if you're using API tokens, oh my gosh, be aware. You can drive and build in the thousands very, very quickly because they were bytecoding a program. They entered in an API. I didn't even know what an API was until Claude told you, right? And next thing, your keys are sitting on Drive, right? And maybe, you know, you put it in GitHub and you didn't put it in a .gitignore file.

[00:29:55] Or you put it in your chat session because Claude told you to. That's now exposed, right? Once that key is exposed, other people can drive up your bill. That's true cost. So, again, it's kind of word to the wise here, which is you need to govern AI usage. You want to identify who's using AI, how they're using AI. And then you want to put an acceptable use policy.

[00:30:24] And then you govern by that acceptable use policy, right? And so I think this is exactly the right fit for managed service providers. Set aside, everyone has told you to go live code applications for your clients. I don't know why that agenda is being pushed. I hear it a lot.

[00:30:50] I think most MSPs are not in a position to do that, frankly, unless you're willing to put a sign, you know, an augmented resource to your clients. And some people do. I get that. But unless you're doing augmented resource staffing, where your clients is going to be very difficult for you to go build their applications. On the other hand, what's a real natural fit is compliance.

[00:31:19] And by the way, ultimately, when we start to think about the future of managed service providers, and it's a very scary future, I'll be the first to admit, there's a lot of disruption coming to the space. Just like PR and marketing agencies, you know, they saw significant disruption in the first wave of AI, right? The next wave of AI people are talking about is, do I really need a managed service provider to do help desk

[00:31:48] when my agent on my device is able to solve my problems, right? And if you're not seeing that now, it's coming, okay? So what's your role in all of this? This is where we lead people to start talking about specialized differentiated services. I do compliance for ThreatMate. It is, no kidding, the biggest pain in the ass. So guess what I'm doing?

[00:32:17] I'm writing compliance agents to do my job, which is compliance, right? And by the way, we have a compliance consultant, right? And we have Vanta, right, as a system of record. We have a third-party auditor. I'm not talking about replacing Vanta, the system of record, or the third-party auditor, which I can't replace.

[00:32:41] Anyone who's done SOC 2 knows there's so much work that's involved, human work, right? So I can do that with an agent or a set of agents. I can collect the data. I can populate all that stuff where you're pulling data from different systems. As an MSP, start looking at compliance as a service. Highly differentiated, big business problem. You can offer it to your clients.

[00:33:08] Everything that we already talked about with relation to AI is going to drive compliance. So I think it's a great area for MSPs to lean into. Wow. I mean, that was very well thought out. I don't think I've heard it quite put out in that way. And I agree that most IT services and managed services companies should not be in the software business. Like, I understand the consulting part. I get it.

[00:33:37] Like, we've been doing this for the eternity, right? But, yeah, building software, no joke. And the liability of that, I think, is a real business challenge, to be honest. Yeah. So 100% with you there.

[00:33:54] So I've heard, since you brought up co-pilot as being very low percentage, I've heard that co-pilot usage, like I talked to a lot of MSPs, I'm sure you do. Like, it's just not widely adopted. It's just not like people are using it the way that I guess Microsoft had hoped that it was going to be, you know, just part of the conversation and just everyday workflow.

[00:34:22] And I think that's probably where this whole conversation, like Pandora's box opens a little bit, right? Where it's like, hey, they're only using this in Excel. That's it. And now they're going over here to do everything else. Like, I feel like that's not well, you know, kept under control in general. Yeah. There's a broader – there are broader studies on this, right? I mean outside of MSP and IT.

[00:34:50] The broader studies show 1% adoption globally of AI. 1%? Okay. All right. So it's crazy because we all spend all of our time talking about AI. And then you realize 1% of the global population has adopted AI. So now put it in terms of North America and it's going to be a larger percentage, right?

[00:35:13] But the reality is the market of users is completely greenfield right now for AI, right? So number one, you're not late to the game. I would just start there. You're not late to the game. There's so much in front of you. There's so much blue water or greenfield, whatever metaphor you like to go. Co-pilot, I would not say failure yet, right?

[00:35:41] It seems to be the dominant model in SMB space because Microsoft is the dominant provider. It's to your point, it's in Excel. That's where people are using it as a prompt writing to generate charts or whatnot. Easy on-ramp. Behind it is choose your model, which is great. I think where this might bite them is on the consumption-based usage, right?

[00:36:09] So they're moving to the consumption-based usage. Absolutely great for Microsoft from a billing and revenue point of view. From a company, it goes back to what we were talking about earlier, the financial cost of AI. That could be a potential nightmare for a CFO when those bills start showing up because it's usage-driven. And everything we want when we manage a business is predictability. Whether it's revenue or cost, we want predictability.

[00:36:36] You run the books, I'm sure, for your firms. And you don't want spike bills that you had no idea were coming, right? And when it's all consumption-based billing, the bill for last month depends on who was doing what in that project. I'm not saying consumption-based billing is wrong. I'm just saying be prepared to govern that usage, right?

[00:37:02] So, you know, in our company, we had some token maxers and we just put an end to it. We just put an end to the token maxers because not the people, but the behavior. Wow. We said no more API usage. You will use subscription only. So, we'll use API in our products. That's fine.

[00:37:30] But not in our usage. So, we work on subscriptions. And guess what? When we hit our limit, we say go outside and touch the grass. Wait for the reset. Right? Because I can't have unexpected $3,000 bills. It's just, you know, I get you wanted to keep going. But so, by the way, the subscription, I think, is a temporary model.

[00:37:58] I think we know it's subsidized. Oh, I agree with you. That's the AI bubble, right? So, what we're doing by using subscriptions is letting someone else pay the cost of that compute, right? At some point, the music is going to stop, right? And people have to grab a chair. And I think that's when this is another broad topic if you want to go there or not.

[00:38:22] But that's when we're going to start to look at open weights models and running locally instead of in cloud. I feel like we took 20 years and the circle has finally come back. You're right. You're right. We started with the server in the closet to, oh, we're going to go cloud, cloud, cloud. And, you know, metered billing, consumption. And we went to now AI in the cloud. Now, oh, back to on-premise. Like, it just, I just find it funny that we're here. Yeah.

[00:38:52] It's scary because, again, like, back to the theme of if you're building it, then you own it and you take on the liability of it. But, like, back to the, well, hey, if you're under the correct plan with so-and-so big, you know, like, you know, open AI, like, they give you different terms. They give you different access. They give you different auditing capability, whatever, for a price. Everything comes at price. Same with cloud. Same with Gemini, same with Cursor, XAI, whatever.

[00:39:22] Like, they still take some on liability, right, because they're delivering a service. The second you are doing what they're supposed to be doing, there is nobody else. Yeah. You're it. Right. So, you're calling out a huge point that, frankly, people haven't begun to grok yet to misuse the grok term or to get back to the original term of grok. So, to your point, you opened up a huge can of worms here.

[00:39:50] So, let's talk about the hug-and-face incident from OpenAI. Most people heard about it when it first came out. You know, they were testing the cyber-offensive capabilities of one of the frontier models, and it broke out of their sandbox. I guess they never learned air gaps at OpenAI. Went to the internet.

[00:40:15] Research how to get answers to the questions they were trying to cheat on. Ended up going a hugging face, broke in. Well, it turned out that original incident turned out to be a massive incident. Massive. Like, they're finding many government sites were broken into. They're still tracing down. They have entire task forces dedicated to tracking down everything that happened and potential code that was left around to stay around. Okay.

[00:40:45] This is still ongoing? It's still ongoing. It's still ongoing. So, that is back to the responsible AI providers. This is the can of worms you just opened. Okay. So, let's just assume that they somehow gain competency in this area in putting guardrails and safety around AI, which they demonstrated they have not yet. Right? By the way, no errors at OpenAI. Same thing has happened at Anthropic.

[00:41:14] I guarantee you it's happening everywhere. Right? Now, go to open weights models where explicitly there are no guardrails. Mm-hmm. So, at least with OpenAI and Claude, the government can't actually say, because of product liability laws, you are responsible for anything bad that happens because you could have, in the product, prevented it. Same thing, consumer protection laws, right? They've always been around a long time, cars and so on.

[00:41:44] You can actually hold those companies responsible. When it comes to both open source, open weight models, who's responsible now? There's no one to point a finger at, right? To your point, it's going to be the person that deploys the model, right? And by the way, with no guardrails, that means the bad guys, of course, can use it to do all kinds of nefarious things. Back in our wheelhouse, right? And then when they trace your IP address, guess what?

[00:42:13] It's on your infrastructure and not somebody else's. Yeah. And, you know, with botnets, that's always been the challenge. So, boy, what a can of worms you open is almost too much to deal with. Going back to popping up a stack, you're right. I do think we are going full circle back to edge computing. Mm-hmm. And you think of a managed service providers, that's where we started, right? Right.

[00:42:39] So, you think about, okay, so maybe the guys who did the blinking lights in the boxes with the cables, hey, we can do that again with open weight models hosting locally, right? And now you start to think about this huge problem we just talked about, which is governance. Well, there's liability now for that company. So, who's going to govern the open weights models that are being deployed?

[00:43:07] They're being deployed, A, to not leak corporate data, B, to control cost, right? Local open weight models, you're not paying the cost of that other than the infrastructure, right? So, I think there's a play there, you know, where MSPs can go back to doing MSP things again, right, with these open weight models. So, it's all just fascinating and interesting to talk about.

[00:43:35] I'd rather talk about that stuff than, you know, MSPs going building workflow applications for accounting firms and manufacturing. Like, anyone who's ever done this, like, you need to be an expert in that particular thing. If you're going to build that, you know what I mean? No, I'm with you. I mean, and so, with everything coming back full circle, and you were saying, hey, maybe hard times ahead for MSPs, and I just want to be cognizant of time.

[00:44:02] But, like, there's still a human element in the middle of all of this, right? Where, like, what is the appetite of the ultimate end user in going to the bot, agent, chat, whatever, versus, no, I actually want to talk to an actual person. Yeah.

[00:44:25] So, like, there's, you know, and I've been a little bit on a soapbox for this because, like, if you look in best-in-class businesses in almost any industry, right? Airlines, Delta, right? Fast food, you got In-N-Out and Chick-fil-A. Department stores Nordstrom. Yeah, like, they're going completely, they're like, hey, we're not, they're not saying that we're not using AI behind the scenes to become more efficient.

[00:44:51] As far as their delivered, perceived front customer experience, it's human beings. Yeah. And they're doubling down on it. By the way, I went through a drive-thru recently at a burger place. I can't remember it. I don't normally go to burger place drive-thrus. It's just not my thing. But I was caravaning with my wife, who does do that. And we stopped at this burger joint. And I won't name it, just to protect the innocent here.

[00:45:21] The drive-thru person was an AI. Have you guys, has this happened to you before? Yes, the local Taco Bell down the street. Taco Bell does that? Okay. They have defaulted to this. And then when it glitches, they go to the human being on the headset, right? Oh, my gosh. No, there was no human being involved in this entire transaction. Okay. And I knew right away, because it's on a speaker.

[00:45:46] It's really funny, because my wife, if she was with me in the car, she would not order a milkshake. But she was in her own car. And so she ordered a milkshake, thinking I wouldn't know, right? Mm-hmm. Mm-hmm. And so the speaker, like, blasted it out. No, we do not have chocolate milkshakes. I'm, like, dying laughing. And it's definitely not a regional accent, which is how I knew right away this was an AI. You know, it was slightly British or something.

[00:46:16] But, yeah, so to your point, it wasn't a great experience of talking to a bot. It just wasn't. I want a human experience. Yeah. So, like, there is definitely this, you know, you said earlier, you know, you're not too late, right? Like, it's still at the very beginning of this. There's a lot of indecision right now, because it's so wild, wild west across all these topics, right?

[00:46:42] Like, the plane hasn't landed on where the best practice is, right? Like, and so it's still being figured out because it's still so new. But in the meantime, all these companies are making boatloads, boatloads of cash, right? You know, like, I think Anthropic yesterday put on out in the public media that they, it was like $17 billion quarter or something.

[00:47:07] And I was like, I mean, they're just, we're printing money here, selling tokens and subscriptions. So, yeah. Lots of credit card burn for sure. And again, they haven't even addressed a fraction of the market yet, right? So, I think, you know, obviously Meta is making a big play in this space now. And what we're beginning to see are these personal assistants. And I'll be honest, I haven't used any yet. I haven't used Muse. I haven't used GrokBot.

[00:47:38] Dots is coming out of OpenAI. The purpose of, I did use OpenClaw way back in the day. But the purpose of these things are to give that consumer personal assistant use case, right? Or to address a larger portion of that 99% of the unwashed, right? And it's, you know, the use cases are things like build me an itinerary as I go to Tampa next week.

[00:48:05] Show me the best flights, you know, book me a rental ticket. Another one is manage my mailbox, right? Help me shop, right? So, based on what's in the fridge, or maybe there's an MCP to your LG fridge at some point. What's in there? And then generate your recipes and the list. Like, you can go through this because I've managed my calendar for my family. I'm not there personally.

[00:48:33] I keep thinking that I want to get there, but I'm not. I'm just not ready to hand over my mailbox, hand over everything in my life to an agent who, at some point, will make autonomous decisions for me, right? That's the idea, right? Is I'm giving away some of my responsibility to an autonomous bot to go do things for me because that's what I'm paying it to do.

[00:48:59] I think if we get there and, okay, we'll get there, that's going to drive spending on a whole nother level than what we're seeing right now. And that's what Mark Zuckerberg sees, right? He sees that massive consumer market. He sees the consumer guy, right? He sees a massive consumer market of people who will sign up for Muse. They'll just do stuff for them and enable that AI adoption in a much larger percentage of the population.

[00:49:29] Interesting. Well, we could probably do this for another hour. I know we're looking at the clock. Just want to, because, you know, just for, you know, making sure everybody understands. If I'm, what do I go, if I'm going to know, what is it? Threatmate.com probably. Yeah. What am I looking for? What does Threatmate help me do as an IT or managed services provider?

[00:49:53] So if you're a managed services provider, we're going to help you find and fix the security exposures before the bad guys find and exploit them. Okay. How this is relevant to our conversation that we've had is the bad guys are using AI to find and exploit very rapidly. And they're doing it on a pace and scale that is exponential from what things used to be.

[00:50:23] What that means for you when you're managing a client's network is if you don't have the equivalent technology that they're using, the bad guys are using, then you're going to, your clients will get compromised. We give you that AI enable adversarial look that the adversary has, but instead of finding and exploiting, we find and fix. That's the key, right? So we will find these security exposures.

[00:50:53] We will go ahead and automate, automatically remediate them. And so that's automated pen testing. People know about that. Vulnerability management. People know about that. Those are the traditional classes of tools, but we use AI and we automate it for our partners. And then we talked about shadow AI because that's another attack surface to being able to report on shadow AI and then govern shadow AI. Awesome.

[00:51:22] Man, this was a, like I said, we could definitely keep this conversation going, no time bearing, but I'm always curious. Like everybody, you know, everybody's an expert in their lane, right? And as we kind of guess the future, right? Where does this all go? What does two years from now look like? What does four years from now look like? What does that mean to the people that we're working with in MSP IT land, right? Big question marks, you know, but these marketing terms, right? I'm with you, by the way.

[00:51:50] Managed intelligence, they managed intelligence provider. They just made up one day and just put it on a billboard. So MSP was the same, by the way. They just made that up on a billboard. Yeah, true, true. So like I bought four marketing guys, right? There's people out there who get paid to do that too. But at the end of the day, like what are you delivering? How are you making money? And is the juice worth the squeeze? Because if the risk begins to outweigh the reward, then is it worth going down that lane?

[00:52:20] I would say probably not if it gets to that, you know, unbalancedness. But unfortunately, to your point, right? Like things are rapidly changing as we are in the air. And so I don't even know if we've evaluated the risk. I will say to your point earlier about cyber insurance, like I've seen so many cyber insurance just come out and say, yeah, 100% exclusion on all things AI. We're not responsible. We can't insure. We don't know how to insure it. You're on your own.

[00:52:47] And like, that's a pretty big billboard. Exclusion. Yeah. If they're like 100% exclusion, not our problem. Go find an insurance company that'll want, you know, insure just that. It means they're having a hard time understanding how to figure out the liability in it. Is what I see from that. Yeah. And I mean, that's one of the challenges with these policies are these exclusions. And another one is accounts without MFA.

[00:53:14] Like when you sign your policy to test, hey, we've got MFA enabled. You were thinking, I have an MFA enabled. But the reality the insurance company looks at is, was it enabled on every account? Because you said yes, right? Right. But if they get in through an account that didn't have MFA enabled, guess what? You just, you know, that was an exclusion. Right.

[00:53:38] So I think with AI being a big unknown to everyone right now, you're better off having some visibility on this. So if you want to learn more about how we can help you manage these attack surface, manage compliance for your clients, jump on a, you know, a train that's going to drive you into the AI era. And I agree with you. It's about, it's about delivering outcomes, right?

[00:54:06] Choose a job, deliver an outcome of that job using AI. We can help you get there. Go to threatmate.com slash demo. Set up a time. We've got a couple of events coming up that we're sponsoring. One is IT Nation. We can get you in there. The other is Secure IT down in Tampa in December. We can also get you there. So sign up for a demo at threatmate.com slash demo. Tell them, hey, I want to go to Tampa or Orlando and we'll get you hooked up.

[00:54:35] Just happens to be drivable between the two. But hopefully Florida in November and December, a bit warmer than I am. Not bad. Yeah. Not bad place. Yeah. This was great. I really enjoyed it, actually. Same. I love the open format, by the way, because it's like, you never know what to do. And by the way, if you ever thought we like train and have like an agenda ahead of time and we like, it's not true. It's not true at all. This is just like wherever the conversation goes. It's better. It's better that way, right?

[00:55:04] It's definitely better that way. You actually gave me an opportunity to riff on some topics I've been thinking about for a long time. And I thank you for giving me the open floor to kind of share my thoughts on where this stuff is going, because I think there are people out there selling stuff that isn't a good fit for what a lot of the partners that we work with do. So I'm with you. I like a lot of your positions on things.

[00:55:29] I think what you've done differently than others I've asked some of those questions to is like there is a methodical foundation, right? You're like, here's why, right? One, two, three. Like, that's how your brain works. I love that. Yeah. And so I hope that, and we're going to put this out there, obviously, for people to watch and download and subscribe and all that stuff. But guys, listen, take advice from people who are out on the street working with you, right? People like you.

[00:55:55] And I like the path to revenue that was laid out in this pod, right? Like, you do not have to be a software company. And like, the people who are convincing you to be one might not be in your best interest. Just go back to where your strength lies rather than something you're not. And I love that message. And by the way, that's a lot less risky because that's, you know, kind of more of what you've been doing this entire time, right?

[00:56:25] Then, you know, becoming, and by the way, if you took away from this, hey, I'm going to become my own open weights hoster. Don't do that. I don't think you should do that. I think that's. Or if you do, then what the hell are you doing? Yeah. Right. Make sure you have governance on a lot of that. I think it's an opportunity, but it's obviously not for everyone. And we'll see how it unfolds as we go along here. Yeah. A hundred percent. This was awesome guys. Please go check out threatmate.com slash demo.

[00:56:55] And I'm looking forward to running into you actually on the road and we'll actually maybe, you know, progress this more in person, but. Sounds good. Yeah. We'll see it at IT Nation, right? It may be. I don't know about that, but we'll definitely see you in Florida at some point. Guys, thank you very much for checking into this episode and looking forward to continuing this. Check out MSPinitiative.com. We'll post all of this there and we'll catch you on the flip side. Thank you for going the distance. I was trying to get you out of here early, but it's okay. It was a good conversation. Great conversation. Thank you very much.

[00:57:25] Have a great one, guys.